336ea5feb911f758d66721e1a61f365444bfc341ac813b997c1b8a7590c32cdc

Analysis

max time kernel
120s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 21:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3dfae01d8287f611ffc3f48755cd9967.html
Size

106KB
MD5

3dfae01d8287f611ffc3f48755cd9967
SHA1

f3b8d33428d098ce1299d6e5695c26fdab75aa86
SHA256

336ea5feb911f758d66721e1a61f365444bfc341ac813b997c1b8a7590c32cdc
SHA512

cf8d96957ee0775c14414d563e4ae833bf7c4add715f99e0edc5f622edcd11bf637f208f2b91f23efa0576ef77c84162bb364a1e9d2f2e8fda25d754a1aca2ea
SSDEEP

3072:l3xsRsDuVxI1XGDesMMby3/ARpKtXcXIKXJqiRZ7k/k2FkJsmZxtONRc1Yo8oSNC:WA0smZxN8oSurp

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C842DA91-A8F0-11EE-86D4-76D8C56D161B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2028b2d0fd3cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410308136"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000c4b5569dda0aa19ecc0002769dc1e45486f074a0638966e1c55bbbef99cbdc93000000000e8000000002000020000000fe68f4447cf18e0b78f9d1517128bcd6a5eb9b00d77fd58adfad17d1ba53b5fb20000000031f409d6e348d162df6660ddba8955854664148b072b87f877a49c9539aed7e400000004de22d086dd3d2d38483d3a2a12fb642770f57dc712b56af7218c622b53c1d017da94d63fd91263cdef3a5113fda14c60f5dd6318e9053621a0640ca0950c212	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000c5f502b16c84cbcdef5d1035ca1dcf0d2989b077de6724617f70c6bb497c5e4b000000000e800000000200002000000070611c4cfe296cc16acc169780da53b3d046d247ed8caad0ce179f5420080c9390000000e1139fda6475bb3c5e936d5f30ffe18b7ab78d6c8ef364a3bb82b392ad90ec548cc62986060445bec53febfac55c828b13b9039f24317a316930013ae9d533618f81f5b92ba893b4eacd7c5788118cc3adab1c925a330d05bed0e549ee7d7d8c59e910eb601aa68e665d789d26b6cb98e0a7a92bdee73f167ab56d1c2255402d3e77b859d7a437e00d2426f36fe90ab640000000af30585aa6ed6792e3d1c41e2b0d53c0266895632e25605012b87e4ad6e57dd27ce67f0e559864045a04fe32ba516c87439fcfa069b9e4f6261eb6eb400b2915	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2376	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2376	iexplore.exe
2376	iexplore.exe
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2672	2376	iexplore.exe	18
PID 2376 wrote to memory of 2672	2376	iexplore.exe	18
PID 2376 wrote to memory of 2672	2376	iexplore.exe	18
PID 2376 wrote to memory of 2672	2376	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3dfae01d8287f611ffc3f48755cd9967.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a03cade4396223bae8200cb3a97b10e3

SHA1
3fe3b0a84ef3b4d5c1f26cdd5faaca87e3b5c2d2

SHA256
124ed940bda3bada8473753a1278dc017adccb82d79173cb88a8e9cb4b332e66

SHA512
710c39141ad27671f6103b4912d0297ac47742c41a737fa504f7e1084617bde884088da8845f8a961264267566879051d75c06320c432e4335e2a1af10e8ba26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8e2f752a1c26b807c25d13989cbff21

SHA1
6e7144cc1c75b104a4ad0d811c9ab9933f625da1

SHA256
d049ef7e5bca4e5da3b0b1474e894fbf9db3234c8f205920367e04cae3ad2bf3

SHA512
1a5e11864aec77cfa260e9216c44a5b33fa9b32a0231afcd28caadc2f6bf5d4ca4bd9e4efc1004b9ff078cc308b9e1308b02d8f97fdc4f9a5a59d08e83306079

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2e47904a092ecd09e9dcc81b53640bd

SHA1
a2809b9859a3fbffc81d212e1c3e7d89d5806871

SHA256
49e96865a93665e80f191ce1c8cc87388d6a1f8444175c1bf22fc6592fe5d935

SHA512
5bc78290af0adc38161743bf4f0a65e426c37c2c4322caef6ea29684aa660df85fbf07b273c4aa579785c50ea294a37fadaff07e7a6d3c543122b7e736807f20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
236a996db5e16dabffa0968798b68dcd

SHA1
a01ec4e490e4b432533fb6fac71362bb4007709c

SHA256
2ae9f7daa3e9e829630c817727d639e796bc1b7f17f00bd4dddcf9a07040b3c2

SHA512
b443210ae44d0e03f92edfe730a7bfd1e4484a6590b3d71ce9c539c296df849b60f6dc8dd4c842bd4731e9740b5b63797ff9f3694311e55b9fd0d6e06cdd92d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4dc7ce2a0eceaae15bc4916ff6e7971b

SHA1
24d4a54e8f0aa0475202f70f7dc72228f1d81725

SHA256
811a5ef7eb654bd7414b1e7e80f138f23022c5cfd3327edb0c0b8f0f4e88ad5c

SHA512
8269893cef78f113b2684b5d237b39e03b835b121effc433cb017fcc0c300cab923267c50ae653135efab4ad258d7aae82ba6b4247dbfc6bbf5d12bbf2ee542e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e82b00cd56f5e9f99b3b566f1a7cf6d

SHA1
68d95dcaf66230cc755a98f4284c546c9a2d3461

SHA256
139bb46dc86fc04ba241dae70b0064210128373c162d4429c2a7e6f28ff5d986

SHA512
b8e736028d4033ca43282da34345cdfee6dc28af160963effc17ed42002c63569b4a18b3a8106c670957b17a8e28305f81b53410225f20c8b662248617859aab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11c56621392c31a0f3f38a7b97c738c0

SHA1
183480222550d2a6b567dabe7ec9e21754a4b1a3

SHA256
155304eeaeec25d7e332ff51906ca0e8374f3ab28c9b8a6b6058df15cfffa102

SHA512
cdc96c32cc74dcfd2bd58f082361ff979c3c44383baffe713a175b31f56c97cdc8e2957b49e24edadd65a95f1577219610755f1481193b32b3b6e64d670e236c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea13113c77c1f313a93bb4608fdd847e

SHA1
4e60b58948573b5b352b6a9ecd626f67be83e62e

SHA256
fa1f519fd60d4eb332cb080b966ebf99090613db0181652d45aac69b884aa481

SHA512
a9030b6fac938b925e2ae0b9c396c639777220f32e28aadf463c0b9119f1f5e48997af9257ecd962ad3aa133b2e0ff37d78868922cedaecfbc444366a02b4803

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD6B1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar769C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit